The European Commission declared its new age verification app technically ready on Wednesday. Within hours, security researchers had torn it apart. The episode undermines confidence in a tool designed to protect children online. It is also the foundation of Europe’s entire digital identity future.
Commission President Ursula von der Leyen and Executive Vice-President Henna Virkkunen presented the app in Brussels. It lets users prove they are over 18 when accessing age-restricted content. They do not need to disclose any personal details. The method is known as zero-knowledge proof. “It is for parents to raise their children. Not platforms. No more excuses,” von der Leyen said at the launch.
Swedish firm Scytáles and Deutsche Telekom developed the app following a €4 million Commission tender. Von der Leyen declared the code fully open source. That transparency allowed researchers to analyse it. They found the flaws within hours.
Hacked in two minutes
On 16 April, UK-based security consultant Paul Moore published a video on X. He showed a full bypass of the app’s authentication in under two minutes. All he needed was physical access to a phone. By editing the app’s configuration files, he reset the PIN and disabled biometric checks. The original verified age credential stayed intact. French cryptographic researcher Olivier Blazy confirmed the findings. “My nephew can take my phone, unlock my app and use it to prove he is over 18,” he said.
The Commission said Moore had tested a demo version, not the final app. A patch was being rolled out on Friday. Chief Spokesperson Paula Pinho stood by the launch. “Yes, it is ready. Maybe we can add — and it can always be improved,” she said.
You might be interested
Stakes beyond the app
The tool builds on the EU Digital Identity Wallet framework, which member states must roll out under eIDAS. In March, more than 400 experts urged the Commission to pause deployment — Blazy among them. He warned the rushed launch “could undermine trust in future digital identity wallets.” Czech MEP Markéta Gregorová said the process was “being rushed under political pressure.”
It is for parents to raise their children. Not platforms. No more excuses. —Ursula von der Leyen
French President Macron convened a video call of European leaders on 16 April. Von der Leyen, Meloni, Sánchez, and Merz all attended. The topic was protecting children online. The Commission insists the production version is secure. Trust takes longer to rebuild than code. Losing it took a single day.
